Information Assurance and Security Discussion Questions

Information Assurance and Security FALL 2020 Week 1: Discussion Ques Questions tions (NOT GRADED) Multiple-Choice Questions (MCQ) 1. Which term describes any action that could damage an asset? A. Risk B. Countermeasure C. Vulnerability D. Threat 2. Bob recently accepted a position as the information security and compliance manager for a medical practice. Which regulation is likely to most directly apply to Bob's employer? A. Federal Information Security Management Act (FISMA) B. Health Insurance Portability and Accountability Act (HIPAA) C. Children's Internet Protection Act (CIPA) D. Gramm-Leach-Bliley Act (GLBA) 3. Rachel is investigating an information security incident that took place at the high school where she works. She suspects that students may have broken into the student records system and altered their grades. If correct, which one of the tenets of information security did this attack violate? A. Confidentiality B. Integrity C. Availability D. Nonrepudiation 4. Which one of the following measures the average amount of time that it takes to repair a system, application, or component? A. Uptime B. Mean time to failure (MTTF) C. Mean time to repair (MTTR) D. Recovery time objective (RTO) 5. Juan's web server was down for an entire day last September. It experienced no other downtime during that month. Which one of the following represents the web server uptime for that month? A. 96.67% (Availability= Uptime/Total amount= 29/30= 0.9667) B. 3.33% C. 99.96% D. 0.04% 6. Which mitigation plan is most appropriate to limit the risk of unauthorized access to workstations? A. Password protection B. Antivirus software C. Deactivating USB ports D. Vulnerability scanning 7. Which security control is most helpful in protecting against eavesdropping on wireless LAN (WLAN) data transmissions that would jeopardize confidentiality? A. Securing wiring closets B. Applying patches promptly C. Implementing LAN configuration standards D. Applying strong encryption 8. Matthew captures traffic on his network and notices connections using ports 20, 22, 23, and 80. Which port normally hosts a protocol that uses secure, encrypted connections? A. 20 B. 22 C. 23 D. 80 9. Which network device is capable of blocking network connections that are identified as potentially malicious? A. Intrusion detection system (IDS) B. Intrusion prevention system (IPS) C. Demilitarized zone (DMZ) D. Web server 10. What is NOT a common endpoint for a virtual private network (VPN) connection used for remote network access? A. Laptop B. Firewall C. Router D. Content filter 11. Which one of the following is typically used during the identification phase of a remote access connection? A. Username B. Password C. Token D. Fingerprint 12. Which one of the following is NOT a good technique for performing authentication of an end user? A. Password B. Biometric scan C. Identification number D. Token 13. Which element of the security policy framework requires approval from upper management and applies to the entire organization? A. Policy B. Standard C. Guideline D. Procedure 14. Which element of the security policy framework offers suggestions rather than mandatory actions? A. Policy B. Standard C. Guideline D. Procedure 15. Chris is writing a document that provides step-by-step instructions for end users seeking to update the security software on their computers. Performing these updates is mandatory. Which type of document is Chris writing? A. Policy B. Standard C. Guideline D. Procedure 16. Which element of the IT security policy framework provides detailed written definitions for hardware and software and how they are to be used? A. Policy B. Standard C. Guideline D. Procedure 17. Which classification level is the highest level used by the U.S. federal government? A. Top Secret B. Secret C. Confidential D. Private True/False Questions 1. Hypertext Transfer Protocol (HTTP) is the communications protocol between web browsers and websites with data in cleartext. A. True B. False 2. The weakest link in the security of an IT infrastructure is the server. A. True B. False 4. The director of IT security is generally in charge of ensuring that the Workstation Domain conforms to policy. A. True B. False 5. The Sarbanes-Oxley (SOX) Act requires all types of financial institutions to protect customers' private financial information. A. True B. False 7. Service-level agreements (SLAs) are optical backbone trunks for private optical backbone networks. A. True B. False 8. Networks, routers, and equipment require continuous monitoring and management to keep wide area network (WAN) service available. A. True B. False 9. A VPN router is a security appliance that is used to filter IP packets. A. True B. False 10. IT security policy framework is like an outline that identifies where security controls should be used. A. True B. False 11. Hypertext Transfer Protocol (HTTP) encrypts data transfers between secure browsers and secure web pages. A. True B. False 12. Cryptography is the process of transforming data from cleartext into ciphertext. A. True B. False 13. The System/Application Domain holds all the mission-critical systems, applications, and data. A. True B. False 14. Encrypting the data within databases and storage devices gives an added layer of security. A. True B. False